{"vulnerability": "cve-2026-94127", "sightings": [{"uuid": "b081eb86-eed1-4d77-ae79-9ee822670195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117315296004023098", "content": "We have just added an important vulnerability affecting F5 BIG-IP (CVE-2026-94127) https://vuldb.com/vuln/408460", "creation_timestamp": "2026-09-22T15:02:36.064494Z"}, {"uuid": "bdb67c2c-f0f0-4143-94da-d218ca2277b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117315299719177302", "content": "EITW 0day in F5 APM. \nhttps://my.f5.com/manage/s/article/K000162605\n\nWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). (CVE-2026-94127)", "creation_timestamp": "2026-09-22T15:03:33.129967Z"}, {"uuid": "4084953d-c5cf-47f1-8ebc-f57214c40d27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw4jnh4myv2t", "content": "CVE-2026-94127 - big-ip\nWhen an access policy and an OAuth profile are set up on a BIG-IP APM virtual server, a specially crafted request can cause the system to execute attacker-controlled code. This can be done\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bigip #f5 #CVE #infosec", "creation_timestamp": "2026-09-22T15:20:07.576886Z"}, {"uuid": "fcd0f8e6-9262-41c4-8f2e-8a32c8d6751a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw4md75pfc2f", "content": "\ud83d\udea8 CVE-2026-94127 \u2014 CVSS 9.3 CRITICAL\n\nWhen a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94127\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T16:08:04.896994Z"}, {"uuid": "2e074ab2-2058-4579-beed-ebb4118feb5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mw4mnrgsus2x", "content": "BIG-IP APM vulnerability CVE-2026-94127\n\n#critical #9.8\n\nmy.f5.com/manage/s/art...", "creation_timestamp": "2026-09-22T16:14:05.761440Z"}, {"uuid": "47440301-cc9b-48a5-881d-f2f1550e2de2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.acn.gov.it/portale/w/f5-big-ip-rilevato-sfruttamento-in-rete-della-cve-2026-94127", "content": "", "creation_timestamp": "2026-09-22T16:15:42.643792Z"}, {"uuid": "a9792aeb-67c8-42de-959d-b74f85d867d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-949", "content": "", "creation_timestamp": "2026-09-22T16:15:45.770106Z"}, {"uuid": "b8aa5b98-dd3d-4051-b70a-68ce0f2f85c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mw4nfzq6r42o", "content": "An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with new F5 hotfixes.\n\n#F5 #BIGIP #CVE202694127 #Cybersecurity #InfoSec #RCE #Vulnerability", "creation_timestamp": "2026-09-22T16:27:34.721824Z"}, {"uuid": "fb785347-9732-4b5d-a46a-50f6106f38d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-28", "content": "", "creation_timestamp": "2026-09-22T16:45:29.188076Z"}, {"uuid": "22381306-b552-41a8-9048-1d646f7a562c", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f7dd33c2-03c3-4ff2-9f9f-66474c7f9169", "content": "", "creation_timestamp": "2026-09-22T20:00:03.436422Z"}, {"uuid": "8d4a02f5-c742-49aa-8fbf-61da1ef13676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://gist.github.com/ichintu/36aaaecfd03b65cd834e3e2ec1b2ba36", "content": "This daily cyber threat intelligence digest highlights critical vulnerabilities, active exploits, and emerging security guidance. Key advisories include default credential exposure in HPE ALE (CVE-2026-76708, CVSS 9.8), an actively exploited heap overflow in F5 BIG-IP APM (CVE-2026-94127), and a DoS flaw in Vector/Logstash (CVE-2026-77620). Additional affected platforms include Erlang OTP and MikroTik RouterOS, with patches and hotfixes available. On the threat actor front, a malicious npm package disguised as a Twilio tool is harvesting credentials, while a new zero-day PoC (BigDiskBuster) disrupts Microsoft Defender updates by exhausting disk space. The digest also features technical analysis of MikroTik disclosures, an open-source architecture for offline clinic ID verification, and a practical guide on avoiding false-positive RCE reports by validating delays with control requests and computed outputs rather than relying on time-based checks. Organizations are urged to apply vendor updates, monitor for credential exfiltration, and strengthen vulnerability validation practices.", "creation_timestamp": "2026-09-22T20:01:40.607492Z"}, {"uuid": "95992178-9b02-4f06-a734-822b62bb9479", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mw4zjbl7p42w", "content": "\ud83d\uded1 CVE-2026-94127\nF5 BIG-IP APM\nCVSS 9.3 / KEV: No\nTL;DR: When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malici\u2026\nhttps://cvesentinel.com/report/CVE-2026-94127?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-22T20:04:07.348978Z"}, {"uuid": "bebe691d-a271-4595-a024-ef157e182b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127", "content": "", "creation_timestamp": "2026-09-22T20:15:06.583173Z"}, {"uuid": "711a37ca-cb19-4659-887c-bb62d98f2416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mw52zat6a522", "content": "CVE-2026-94127 now in CISA KEV.\nActively exploited F5 BIG-IP APM zero-day.\n\u2022 Heap-based buffer overflow\n\u2022 CVSS v4 9.3\n\nhttps://thecircuitry.to/article/cisa-adds-actively-exploited-f5-big-ip-apm-flaw-to-kev-catalog-mud3ryl7", "creation_timestamp": "2026-09-22T20:30:57.797508Z"}, {"uuid": "e48c809d-fcef-4daa-b73c-5ecdefce2728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117316666030287896", "content": "When it rains, it pours. F5 BIG-IP APM also has an exploited CVE!\nhttps://ifin.network/t/f5-big-ip-cve-2026-94127-rce-exploited/855\n#ThreatIntel #ThreatIntelligence #IFIN", "creation_timestamp": "2026-09-22T20:51:56.250402Z"}, {"uuid": "9dabcb2e-bccf-4b4f-acca-641c4616d388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mw55z2eriz2v", "content": "K000162605: BIG-IP APM vulnerability CVE-2026-94127", "creation_timestamp": "2026-09-22T21:24:31.669335Z"}, {"uuid": "6ad342bf-e405-452e-a9d0-42c962aac599", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mw5ddlqbs32c", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-94127", "creation_timestamp": "2026-09-22T22:59:54.507060Z"}, {"uuid": "0203d3b3-e404-4dbb-9d74-5b86cf61c98f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.acn.gov.it/portale/w/f5-big-ip-rilevato-sfruttamento-in-rete-della-cve-2026-94127", "content": "Rilevato lo sfruttamento in rete di una vulnerabilit\u00e0, identificata tramite la CVE-2026-94127, presente in BIG-IP APM. Tale vulnerabilit\u00e0, qualora sfruttata, potrebbe consentire a utenti malintenzionati remoti di eseguire codice arbitrario sui sistemi interessati.", "creation_timestamp": "2026-09-23T01:00:44.451949Z"}, {"uuid": "06987729-8c70-457c-872f-cfe749649d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mw5uc2gdc22c", "content": "~Certeu~\nActively exploited unauthenticated RCE affects BIG-IP APM; patch urgently.\n-\nIOCs: CVE-2026-94127\n-\n#CVE202694127 #F5 #ThreatIntel", "creation_timestamp": "2026-09-23T04:03:16.780522Z"}, {"uuid": "e28cf65a-a056-4beb-9b4c-07d1152d50d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/f5-big-ip-remote-code-execution-vulnerability_20260923", "content": "", "creation_timestamp": "2026-09-23T04:48:28.572197Z"}, {"uuid": "6ef3a239-d040-4ab4-9545-a30b603794ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mw5xliytoj2d", "content": "Daily IT Security Digest \u2014 2026-09-23\nconcerning because attackers now possess proprietary code that could reveal previously unknown vulnerabilities (0-days) in widely deployed F5 appliances. CVE-2026-94127 (RCE) and CVE-2026-93616 (Check Point RCE) are among the newly exposed concerns.", "creation_timestamp": "2026-09-23T05:02:14.474200Z"}, {"uuid": "4662e55a-82f2-4849-a54f-b5c7f9f20f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mw64jmd4zl2x", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-94127: \u26a0\ufe0f CVE-2026-94127: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-94127-when-a-big-ip-apm-access-policy", "creation_timestamp": "2026-09-23T06:30:39.853250Z"}, {"uuid": "865c5200-c8de-418f-97b0-193d336080ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://t.me/infosec_ita_notizie/4103", "content": "\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026\n\n\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \ud83d\udd34 IN PRIMO PIANO Zero-day critico su F5 BIG-IP APM: attacchi gi\u00e0 in corso, controllo remoto senza autenticazione \u00c8 stata scoperta una vulnerabilit\u00e0 zero-day (CVE-2026-94127) nel modulo\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-09-23\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-09-23T07:00:04.913530Z"}, {"uuid": "35eaeff4-de78-4797-a43e-4e29c47e15f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117319180197500080", "content": "CVE-2026-94127: Critical zero-day in F5 BIG-IP APM exploited for RCE on OAuth Authorization Servers. Patch urgently or use F5's iRule mitigation. Monitor for OAuth auth failures and TMM SIGABRTs. https://radar.offseq.com/threat/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks-191545153729ae57 #OffSeq #F5 #ZeroDay #RCE #Vuln", "creation_timestamp": "2026-09-23T07:30:24.335193Z"}, {"uuid": "5a8950c7-c68f-44c2-8d6c-723345d82de2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mw67ui7bwn24", "content": "CVE-2026-94127 is a CRITICAL zero-day in F5 BIG-IP APM (OAuth Authorization Servers) with active RCE exploitation. Patch now or apply iRule mitigation. https://radar.offseq.com/threat/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks-191545153729ae57 #OffSeq #F5 #ZeroDay", "creation_timestamp": "2026-09-23T07:30:26.375193Z"}, {"uuid": "1a9aef27-f7cf-49a5-8125-c6747fa1f486", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw6albhwba2q", "content": "Threat actors exploit CVE-2026-94127 in BIG-IP APM OAuth Authorization Server setups to gain unauthenticated remote code execution, prompting urgent patching.\n", "creation_timestamp": "2026-09-23T07:43:11.240344Z"}, {"uuid": "01ad886a-8c42-4f43-8e68-89ea4a5a1984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mw6am2mdk524", "content": "Threat actors exploit CVE-2026-94127 in BIG-IP APM OAuth Authorization Server setups to gain unauthenticated remote code execution, prompting urgent patching.\n", "creation_timestamp": "2026-09-23T07:43:37.227473Z"}, {"uuid": "1f8ee877-8af5-454d-b049-debe18f3c851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/bsi.bund.de/post/3mw6c33ncus2e", "content": "\ud83d\udce2\u2757\ufe0f Der Hersteller F5 ver\u00f6ffentlichte ein Advisory zu einer ausgenutzten Zero-Day Schwachstelle in seinem Produkt BIG-IP Access Policy Manager (APM) zur sicheren Zugriffsteuerung und Anwendungszugriff: CVE-2026-94127, CVSS-Score 9.8/10 (\"kritisch\")\n\n\ud83d\udc49\ufe0f https://www.bsi.bund.de/dok/1209384", "creation_timestamp": "2026-09-23T08:09:55.875164Z"}, {"uuid": "1961f4c2-751f-4082-b16c-87dac765c37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://social.bund.de/users/bsi/statuses/117319335561645833", "content": "Der Hersteller F5 ver\u00f6ffentlichte ein Advisory zu einer ausgenutzten Zero-Day Schwachstelle in seinem Produkt BIG-IP Access Policy Manager (APM) zur sicheren Zugriffsteuerung und Anwendungszugriff: CVE-2026-94127, CVSS-Score 9.8/10 (\"kritisch\")\nF5 gibt an, dass die Schwachstelle bereits aktiv ausgenutzt wird. IT-Sicherheitsverantwortliche sollten unverz\u00fcglich die Patchst\u00e4nde pr\u00fcfen und, sofern erforderlich, die verf\u00fcgbaren Engineering Hotfixes einspielen.\n\ud83d\udc49\ufe0f https://www.bsi.bund.de/dok/1209384", "creation_timestamp": "2026-09-23T08:10:40.959112Z"}, {"uuid": "93c75043-f0b4-468b-9fca-356ea9181f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117319383133736126", "content": "Our CTI team identified a lot of activities targeting F5 BIG-IP (CVE-2026-94127) https://vuldb.com/vuln/408460/cti", "creation_timestamp": "2026-09-23T08:22:00.816361Z"}, {"uuid": "f6c2f916-b0f9-4859-a6eb-f70233a4f812", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mw6dtt2nc22o", "content": "CVE-2026-94127 enables unauthenticated remote code execution on F5 BIG-IP APM when APM functions as an OAuth authorization server, requiring hotfixes.\n", "creation_timestamp": "2026-09-23T08:41:39.651828Z"}, {"uuid": "c5f651c2-ec65-40c7-89ed-f5d6698fa9e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw6dvnpyed2y", "content": "CVE-2026-94127 enables unauthenticated remote code execution on F5 BIG-IP APM when APM functions as an OAuth authorization server, requiring hotfixes.\n", "creation_timestamp": "2026-09-23T08:42:40.477831Z"}, {"uuid": "2064faa7-ed52-4dc1-b797-cd385d3aaf87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mw6dvpccpn2o", "content": "CVE-2026-94127 enables unauthenticated remote code execution on F5 BIG-IP APM when APM functions as an OAuth authorization server, requiring hotfixes.\n", "creation_timestamp": "2026-09-23T08:42:42.374459Z"}, {"uuid": "e2ea3eab-bd79-4d65-bcde-74cfe4da2509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw6fojcw7a2w", "content": "\ud83e\udd16 CVE-2026-94127: critical F5 BIG-IP APM zero-day exploited in the wild for unauthRCE. Affects systems where APM acts as OAuth auth server. Hotfixes released.\nhttps://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html", "creation_timestamp": "2026-09-23T09:14:27.834775Z"}, {"uuid": "a4688ebb-0090-4834-aea0-82a199986568", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2078", "content": "", "creation_timestamp": "2026-09-23T09:51:03.175368Z"}, {"uuid": "eb04c615-d58c-494c-aa37-e40a07a748a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html", "content": "Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.\n\nThe flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.", "creation_timestamp": "2026-09-23T10:00:51.996183Z"}, {"uuid": "6c7e20e0-25b1-4573-9b41-16a4eb6e8152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw6j3go3bv2l", "content": "F5 and CISA say CVE-2026-94127, a critical BIG-IP APM flaw with CVSS 9.8, is being used as a zero-day for unauthenticated remote code execution. Hotfixes are available. #F5 #BIGIPAPM #CVE202694127", "creation_timestamp": "2026-09-23T10:15:22.820016Z"}, {"uuid": "71208054-9caa-433c-8e85-be5eedb4e2e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117319888106479032", "content": "F5 BIG-IP APM (OAuth Authorization Server) is facing a CRITICAL RCE zero-day, CVE-2026-94127, with active exploitation. Versions 21.1.0, 17.5.0 \u2013 17.5.1, 17.1.0 \u2013 17.1.3 affected. Apply hotfixes now. Details: https://radar.offseq.com/threat/critical-f5-big-ip-vulnerability-exploited-as-zero-day-024f528e7ee83eed #OffSeq #F5 #ZeroDay #Infosec", "creation_timestamp": "2026-09-23T10:30:26.189247Z"}, {"uuid": "63d762fa-31d5-4767-891f-c2f85c57814d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mw6jwfomyc2j", "content": "CRITICAL zero-day (CVE-2026-94127) in F5 BIG-IP APM (OAuth Auth Server) enables unauth RCE. Actively exploited. Patch hotfixes for 21.1.0, 17.5.0 \u2013 17.5.1, 17.1.0 \u2013 17.1.3 ASAP. https://radar.offseq.com/threat/critical-f5-big-ip-vulnerability-exploited-as-zero-day-024f528e7ee83eed #OffSeq #F5 #Ze...", "creation_timestamp": "2026-09-23T10:30:28.494768Z"}, {"uuid": "25aa04cc-05fd-4947-866c-aa1892ea49fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mw6mrbpgcm2x", "content": "F5 BIG-IP APM\u306b\u672a\u8a8d\u8a3cRCE\u306e\u8106\u5f31\u6027(CVE-2026-94127)\u304c\u5b58\u5728\u3002OAuth\u8a8d\u53ef\u30b5\u30fc\u30d0\u30fc\u3068\u3057\u3066\u6a5f\u80fd\u3059\u308b\u30b7\u30b9\u30c6\u30e0\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3001\u653b\u6483\u8005\u306f\u30ed\u30b0\u30a4\u30f3\u306a\u3057\u3067\u30b3\u30fc\u30c9\u5b9f\u884c\u53ef\u80fd\u3002", "creation_timestamp": "2026-09-23T11:21:17.715946Z"}, {"uuid": "5fb666d3-1349-49ff-ae6d-7b891ce63e40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw6nbllrjm2d", "content": "F5 has patched a critical BIG-IP APM zero-day, CVE-2026-94127, exploited in remote code execution attacks on systems with OAuth authorization server settings enabled. #F5 #BIGIPAPM #CVE202694127", "creation_timestamp": "2026-09-23T11:30:24.061969Z"}, {"uuid": "2ad08f02-9256-42e2-9b8d-a48560faccd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mw6o3m6xjc2f", "content": "When that alert wakes you up at 3am, don't call it a \"potential anomaly. It's unauthenticated remote code execution on your perimeter. For anyone running F5 BIG-IP APM, that is exactly what CVE-2026-94127 is.\n\n#vulnerability #infosec", "creation_timestamp": "2026-09-23T11:44:57.379181Z"}, {"uuid": "099f89d3-e035-404d-833b-b27469cb1ee4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mw6obmqekk2f", "content": "CVE-2026-94127 is trending. Hype score 10, currently #2 on cvemon.\n\nWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-94127", "creation_timestamp": "2026-09-23T11:48:19.022216Z"}, {"uuid": "55921b3b-dd39-4c24-a44a-22a23c148616", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritisk-sarbarhet-i-big-ip-apm.html", "content": "", "creation_timestamp": "2026-09-23T12:15:02.379978Z"}, {"uuid": "f0b8997c-68cd-4bea-9cf5-faa603779881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://t.me/infosec_ita_notizie/4103", "content": "\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026\n\n\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \ud83d\udd34 IN PRIMO PIANO Zero-day critico su F5 BIG-IP APM: attacchi gi\u00e0 in corso, controllo remoto senza autenticazione \u00c8 stata scoperta una vulnerabilit\u00e0 zero-day (CVE-2026-94127) nel modulo\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-09-23\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-09-23T13:00:05.286686Z"}, {"uuid": "4a220bd4-8f1a-4132-91b4-176ff5a7f218", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mw6so7w3i52q", "content": "F5 patched CVE-2026-94127 today, a heap-based buffer overflow in BIG-IP APM giving unauthenticated attackers remote code execution when APM is configured as an OAuth authorization server. F5 says it has been exploited. CISA added it to KEV, federal deadline Friday.", "creation_timestamp": "2026-09-23T13:06:57.365806Z"}, {"uuid": "fff8a7c7-825a-4353-9679-b508532ffcb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mw6studqtb2x", "content": "\ud83d\udd17 CVE : CVE-2026-94127", "creation_timestamp": "2026-09-23T13:10:06.361263Z"}, {"uuid": "f1ec92f5-0227-43ec-a1fc-88b042ee977b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mw6w4w24go2u", "content": "K000162605: BIG-IP APM vulnerability CVE-2026-94127 #patchmanagement", "creation_timestamp": "2026-09-23T14:08:50.861562Z"}, {"uuid": "eb11a69d-26c2-43f2-bf07-0f68688573d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6881229b-5680-4ea1-a3bc-e323ad246649", "content": "", "creation_timestamp": "2026-09-23T14:16:25.193547Z"}, {"uuid": "ad491dc2-b38c-40ea-856a-375b35ee8e5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f4z25s25", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:01.694502Z"}, {"uuid": "646b7762-d0af-4401-9e8c-9312bd3e2631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f4zxhc25", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:02.155328Z"}, {"uuid": "ec2c2898-02ea-4f52-ad49-1ec12a89320d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f4zygk25", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:02.640166Z"}, {"uuid": "f9171dec-9901-4332-9beb-2aa08d459242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f523ec25", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:03.073717Z"}, {"uuid": "f502b39f-6c37-4015-91e1-ecc079de4104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f524dk25", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:03.518308Z"}, {"uuid": "cf1b4ae4-e021-41ee-972d-9de9cc6e860c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f525cs25", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:03.979994Z"}, {"uuid": "5e8514c7-d26b-47ec-a31b-12cfc5f90183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f525ct25", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:04.424755Z"}, {"uuid": "f4f996f6-0439-4a60-bf0f-7f0f9cf3d429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mw72f526c325", "content": "\ud83d\udea8 Patch alert: F5 BIG-IP APM has an actively exploited zero-day (CVE-2026-94127) allowing remote code execution. CISA gave US agencies until Friday. 14,700+ instances exposed online. (via BleepingComputer) 3/8\n#ZeroDay #OpenAI #Anthropic 8/8", "creation_timestamp": "2026-09-23T15:25:04.899921Z"}, {"uuid": "e394341f-9d13-4332-8e65-6d2ac1583706", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mw733usvsy2h", "content": "Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127 , a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM)....\n\n\ud83d\udd17 https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm", "creation_timestamp": "2026-09-23T15:37:44.770272Z"}, {"uuid": "5813b3da-84f7-4c08-8161-5028b16e5df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mw75i2vwnb2o", "content": "\ud83d\udd34 EXPLOITED\n\nF5 BIG-IP APM has a max-severity flaw (CVE-2026-94127) that lets a stranger run code with no login, but only when APM is your OAuth sign-on server.\n\nExploited now, CISA deadline Sept 25.\n\nFix: apply F5's hotfix today.", "creation_timestamp": "2026-09-23T16:20:21.937474Z"}, {"uuid": "e3fbdff6-dbe0-4569-8e63-ba1c3fc4d5bc", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fd1ef58c-7221-498a-9b82-d2d318be7af2", "content": "", "creation_timestamp": "2026-09-23T17:00:31.616097Z"}, {"uuid": "5307d17b-f0a3-4eb4-b445-b7644f57619f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117321683644705225", "content": "\ud83d\udcf0 F5 BIG-IP APM Zero-Day (CVE-2026-94127) Actively Exploited for RCE\nF5 BIG-IP APM is being actively exploited via a critical RCE zero-day (CVE-2026-94127). CISA has added it to the KEV catalog, mandating an urgent patch. The flaw affects systems with a specific OAuth config. #F5 #BIGIP #CyberSecurity #RCE\n\ud83d\udd17 https://cyber.netsecops.io/articles/f5-patches-critical-big-ip-apm-zero-day-cve-2026-94127-under-active-exploitation/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-23T18:07:04.633787Z"}, {"uuid": "43f492aa-aee5-40be-b2a0-5b0bfeeefcbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mw7dhozas52r", "content": "F5 BIG-IP APM is being actively exploited via a critical RCE zero-day (CVE-2026-94127). CISA has added it to the KEV catalog, mandating an urgent patch. The flaw affects systems with a specific OAuth config. #F5 #BIGIP #CyberSecurity #RCE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-23T18:07:31.770066Z"}, {"uuid": "486a8042-f42c-47e1-8146-4c0b1265f55d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mw7fspqvsf25", "content": "F5 has reported a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager, allowing remote code execution without authentication. The flaw, a heap-based buffer overflow, affects specific configurations using APM as an OAuth Authorization Server. It has a CVSS score of 9.8.", "creation_timestamp": "2026-09-23T18:49:29.493993Z"}, {"uuid": "b75ffa8d-ff93-4580-a108-09692207d4ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-f0e632bc-9d08437efe16bd6d", "content": "F5 warns of a critical BIG-IP APM zero-day, CVE-2026-94127, allowing remote code execution. Attackers are already exploiting it. F5 has released emergency security updates for a critical vulnerability, tracked as CVE-2026-94127 (CVSS score of 9.8), in BIG-IP Access Policy Manager (APM) that attackers are already exploiting in the wild. The flaw can allow an unauthenticated [\u2026]F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks", "creation_timestamp": "2026-09-23T19:21:03.799507Z"}, {"uuid": "73b48b71-5a31-4b5d-8ebc-bf411f04fbb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mw7hmbvmpls2", "content": "F5 warns of a critical BIG-IP APM zero-day, CVE-2026-94127, allowing remote code execution. Attackers are already exploiting it. F5 has released emergency security updates for a critical vulnerability, tracked as CVE-2026-94127 (CVSS score of 9.8), in BIG-IP Access Policy Manager (APM) that [\u2026]", "creation_timestamp": "2026-09-23T19:23:56.166352Z"}, {"uuid": "10cfabdc-8e29-48f5-bdbb-998fb1e2e501", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/583eda53-f9a1-47e9-8218-d9ff3f75c799", "content": "", "creation_timestamp": "2026-09-23T20:00:02.432694Z"}, {"uuid": "b033436e-e53c-41e0-a2c2-f38a6ff50359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mw7q3bhc6t2g", "content": "CVE-2026-94127: Critical F5 BIG-IP APM Zero\n\n", "creation_timestamp": "2026-09-23T21:53:13.577681Z"}, {"uuid": "6913522a-34b2-4722-8357-adc50ee8dbbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mw7vf3xsk72i", "content": "Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs", "creation_timestamp": "2026-09-23T23:28:12.657337Z"}, {"uuid": "6c9e7085-c812-4035-9e72-e0ca9db482e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mw7vze7wpw2q", "content": "Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs", "creation_timestamp": "2026-09-23T23:39:31.500707Z"}, {"uuid": "ac58c853-b4c3-407a-b732-048c7e9d335d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mw7wboajbs2y", "content": "Schmeckles. F5's BIG-IP APM turned OAuth Authorization Server into an unauthenticated RCE buffet. CVE-2026-94127, 9.8, already exploited, CISA KEV, agencies have until Friday. Morty, the box that checks your badge just handed out root. day267.009", "creation_timestamp": "2026-09-23T23:44:12.262601Z"}, {"uuid": "0e76919c-db6d-498e-a6f5-736336c93bf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mw7xietrfs2p", "content": "F5 BIG-IP APM\u3067\u8a8d\u8a3c\u4e0d\u8981\u306eRCE \u8106\u5f31\u6027 CVE-2026-94127\u3001\u5b9f\u969b\u306e\u653b\u6483\u3067\u60aa\u7528\u78ba\u8a8d\u3000CVSS 9.8\u30fbCISA KEV\u63b2\u8f09 \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "creation_timestamp": "2026-09-24T00:05:52.353249Z"}, {"uuid": "1b6ab442-b18f-4b9b-8f4e-b358d1db5d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwa3jvprdoj2", "content": "Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "creation_timestamp": "2026-09-24T01:18:17.253799Z"}, {"uuid": "9d5a05b2-7e82-4f19-a55e-9486dc9ec9e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwa4pxvuxi2f", "content": "Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs", "creation_timestamp": "2026-09-24T01:39:32.633537Z"}, {"uuid": "40529a57-5759-4435-9bb0-fcabfbd0fea3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwa4qspjkf2t", "content": "watchTowr details CVE-2026-94127, an unauthenticated heap overflow in F5 BIG-IP reachable through the auth header itself, leading to RCE. An oversized header is apparently all it takes on hardware that costs a fortune. Patching advice follows shortly, presumably.", "creation_timestamp": "2026-09-24T01:42:37.278773Z"}, {"uuid": "bdb6cd88-8ec5-4f27-8e5d-f116d0c62523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwabmkgbi72e", "content": "\ud83d\udccc CVE-2026-94127 - When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution ... https://www.cyberhub.blog/cves/CVE-2026-94127", "creation_timestamp": "2026-09-24T03:07:06.877927Z"}, {"uuid": "05d5a24a-24ca-49e7-9550-c8739deac63e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwaees4ckp2i", "content": "\ud83d\udcf0 F5 Rilis Patch untuk Zero-Day BIG-IP APM yang Dieksploitasi dalam Serangan RCE\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/24/f5-big-ip-apm-cve-2026-94127-zero-day-rce/\n\n#accessPolicyManager #activeExploitation #big-ipApm #cisa #cisaKev #cve #cve-2026-94127 #cyberAttack #c", "creation_timestamp": "2026-09-24T03:56:27.559102Z"}, {"uuid": "8fc62218-a789-4561-8299-3d2c85d41f11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwaf2m2nob2l", "content": "~Watchtowr~\nUnauthenticated OAuth requests can trigger heap overflow and remote code execution on vulnerable BIG-IP APM.\n-\nIOCs: CVE-2026-94127\n-\n#CVE-2026-94127 #F5 #ThreatIntel", "creation_timestamp": "2026-09-24T04:08:39.976735Z"}, {"uuid": "4a9e068d-ddca-4aad-a3df-d5e80151b3c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy/post/3mwahyt5axvb2", "content": "Is This A Joke? In The Auth Header? (#F5 BIG-IP UnAuth Heap-Overflow to #RCE CVE-2026-94127)\n\nhttps://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "creation_timestamp": "2026-09-24T05:01:43.253200Z"}, {"uuid": "0627a45d-b3a3-4e93-b122-a256b53c3990", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwai2qdfto2x", "content": "Daily IT Security Digest \u2014 2026-09-24\nSimultaneously, CVE-2026-94127, a critical remote code execution zero-day in the BIG-IP APM OAuth Authorization Server, is being actively exploited in the wild. Affected versions include 21.1.0 and 17.5.0\u201317.5.1 and 17.1.0\u201317.1.3. Organizations should apply", "creation_timestamp": "2026-09-24T05:02:24.967483Z"}, {"uuid": "acf1efef-b800-4924-ba7b-3c41eb625062", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwailcp3ts2d", "content": "F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers\n\nAttackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.\n\nThe flaw,\u00a0CVE-2026-94127, affects \u2026\n#hackernews #news", "creation_timestamp": "2026-09-24T05:11:41.812133Z"}, {"uuid": "6e5a9111-cfbd-4e5f-974a-fa8713e42c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwanmp5ywy2a", "content": "Top 3 CVE for last 7 days:\nCVE-2026-86296: 25 interactions\nCVE-2026-7273: 20 interactions\nCVE-2026-58704: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-94127: 10 interactions\nCVE-2026-69836: 7 interactions\nCVE-2026-87902: 7 interactions\n", "creation_timestamp": "2026-09-24T06:41:57.580100Z"}, {"uuid": "2430e63f-e3ef-4666-926d-3147da53f89d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://t.me/thehackernews/10137", "content": "\u203c\ufe0f WARNING - F5\u2019s BIG-IP APM 0-day is being exploited for unauthenticated RCE.\n\nCVE-2026-94127 affects systems where APM acts as an OAuth authorization server. F5 has released hotfixes, and CISA added the flaw to KEV.\n\nWhat to patch and check: https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html", "creation_timestamp": "2026-09-23T14:25:24.000000Z"}, {"uuid": "716f430b-58fb-46e8-9f0d-5ba01f1f1c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mwarymr6ol23", "content": "F5 confirms exploitation of CVE-2026-94127 (CVSS 9.8): unauth RCE in BIG-IP APM's OAuth Authorization Server role. CISA KEV same day, deadline Friday. 14,700+ exposed IPs. Patch or apply F5's interim  \n\ud83c\uddec\ud83c\udde7 diesec.com/2026/09/f5-b...\n\ud83c\udde9\ud83c\uddea diesec.com/de/2026/09/f... \n#cybersecurity", "creation_timestamp": "2026-09-24T08:00:12.125145Z"}, {"uuid": "01df1ce6-c4a1-4f66-9c9e-ec94f2c54153", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwas2timvx2f", "content": "\u6ce8\u610f\u559a\u8d77: F5 BIG-IP Access Policy Manager\u306b\u304a\u3051\u308b\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\uff08CVE-2026-94127\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nF5\u306eBIG-IP APM\u306b\u304a\u3044\u3066\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u8106\u5f31\u6027\uff08CVE-2026-94127\uff09\u304c\u5831\u544a\u3055\u308c\u307e\u3057\u305f\u3002OAuth Authorization Server\u3068\u3057\u3066\u69cb\u6210\u3055\u308c\u305fAPM\u3067\u3001\u8a8d\u8a3c\u306a\u3057\u306e\u30ea\u30e2\u30fc\u30c8\u653b\u6483\u8005\u304c\u4efb\u610f\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002\u65e2\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u304a\u308a\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30d0\u30fc\u30b8\u30e7\u30f3\u306fBIG-IP APM 21.1.0\u53ca\u307317.5.0-17.5.1\u300117.\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-24T08:01:26.036977Z"}, {"uuid": "cf787947-4256-483f-ac34-4bc5f188980a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwaxljnbxj2a", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: F5 BIG-IP Access Policy Manager\u306b\u304a\u3051\u308b\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\uff08CVE-2026-94127\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260028.html\n", "creation_timestamp": "2026-09-24T09:40:14.693276Z"}, {"uuid": "a8fda39e-6bf0-4bd9-9e4c-f58f63e073ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mwb3evijlg24", "content": "[RSS] Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)\n\n\n labs.watchtowr.com -> \n\n\nOriginal->", "creation_timestamp": "2026-09-24T10:48:07.162098Z"}, {"uuid": "e00ab5b5-f1af-4945-a5dd-6ec64b686bb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwb42edqjw2k", "content": "\ud83d\udce2 CVE-2026-94127 : Vuln\u00e9rabilit\u00e9 critique F5 BIG-IP APM exploit\u00e9e en zero-day\n\nSecurityWeek, article de Ionut Arghire publi\u00e9 le 23 septembre 2026. F5 et la CISA ont \u00e9mis conjointement une alerte concernant l'exploitation active d'une\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#APM #F5BIGIP #Cyberveille", "creation_timestamp": "2026-09-24T11:00:07.170009Z"}, {"uuid": "f6f7bb9a-9638-4ed2-80e6-12adf8ae59b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwbaaqrejk2c", "content": "F5 BIG-IP APM heap overflow (CVSS 9.8): unauth RCE when an access policy and OAuth profile share a virtual server. actively\u2026 https://0daynews.com/articles/2026-09-23-f5-big-ip-apm-cve-2026-94127-kev-rce/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3422", "creation_timestamp": "2026-09-24T12:15:17.514885Z"}, {"uuid": "efc7baca-59c6-4f0d-b121-de1a8ba9059d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mwb4hii22k2q", "content": "\u3010\u7dca\u6025\u3011F5 BIG-IP APM \u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-94127 / CVSS v3.1 9.8 CRITICAL\uff09\n\n\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u307e\u3067\u5c4a\u304d\u30019\u670822\u65e5\u306bCISA\u306eKEV\u3078\u8ffd\u52a0\u3055\u308c\u307e\u3057\u305f\u3002\u5bfe\u5fdc\u671f\u9650\u306f9\u670825\u65e5\u3067\u3059\u3002\n\u5f71\u97ff\u3059\u308b\u306e\u306f\u300cOAuth\u8a8d\u53ef\u30b5\u30fc\u30d0\u300d\u3068\u3057\u3066\u69cb\u6210\u3057\u305f\u5834\u5408\u3060\u3051\u3067\u3001OAuth\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u5c02\u7528\u306a\u3089\u5bfe\u8c61\u5916\u3067\u3059\u3002\nCISA\u306f\u30d1\u30c3\u30c1\u524d\u306e\u30d5\u30a9\u30ec\u30f3\u30b8\u30c3\u30af\u8abf\u67fb\u3092\u6c42\u3081\u3066\u3044\u307e\u3059\u3002\n\nforsmile.jp/articles/f5-...", "creation_timestamp": "2026-09-24T11:07:27.059318Z"}, {"uuid": "4cfa6387-8a97-4c16-8385-8bc53bb45593", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/f5-big-ip-apm-rce", "content": "24. September 2026\n\nBeschreibung\n\nIn der OAuth Komponente von F5 BIG-IP APM existiert eine kritische Schwachstelle, welche dass unauthentifizierte Ausführen von Schadcode aus der Ferne erlaubt. Betroffen sind Systeme, welche BIG-IP APM als Authorisierungsserver via OAuth-Funktionalität nutzen.\n\nEs liegen Informationen vor, dass diese Lücke bereits aktiv ausgenutzt wird, daher empfiehlt sich die Überprüfung der eigenen Instanzen auf etwaige Indicators of Compromise, welche ebenfalls im veröffentlichten Advisory enthalten sind.\n\nCVE-Nummer(n): CVE-2026-94127\n\nCVSS v4.0 Base Score: 9.3\n\nAuswirkungen\n\nAngreiferInnen können die Lücke durch setzen eines zu langen Authorization-Headers trivial ausnutzen. Die Ausnutzung der Lücke, mithilfe einer speziell präparierten Anfrage, führt zur unauthentifizierten Ausführung von Befehlen.\n\nBetroffene Systeme\n\n\n\nBIG-IP APM\n\n\n\nVersion 21.1.0\n\n\n\nBIG-IP APM\n\n\n\nVersion 17.5.0 - 17.5.1\n\nVersion 17.1.0 - 17.1.3\n\n\n\n\nAbhilfe\n\nF5 stellt Hotfixes bereit, die die Sicherheitslücke schließen. Sollten Updates nicht zeitnahe eingespielt werden können, empfiehlt F5 zur zwischenzeitlichen Mitigation das Erstellen einer iRule welche über den Support bezogen werden kann.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nK000162605: BIG-IP APM vulnerability CVE-2026-94127https://my.f5.com/manage/s/article/K000162605\n\nIs This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "creation_timestamp": "2026-09-24T11:04:47.000000Z"}, {"uuid": "b6cc5995-a38e-461a-b89d-4c14340878d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117326329665895250", "content": "Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)#CVE_2026_94127 https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "creation_timestamp": "2026-09-24T13:48:36.215002Z"}, {"uuid": "31a6fa9a-e608-4ef7-b05f-15ba7c870833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://t.me/pphm_HackerNews/3267", "content": "\ud83d\udd34 F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks\n\nF5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks.\n\nBIG-IP APM (short for Access Policy Manager) is the company's centralized access management proxy solution that helps admins secure access to their organizations' networks, applications, cloud, and application programming interfaces (APIs).\n\nTracked as CVE-2026-94127, the flaw affects instances configured as an OAuth Authorization Server when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server.", "creation_timestamp": "2026-09-23T12:31:01.000000Z"}, {"uuid": "bdf7258f-3659-4443-904e-fb042c15d147", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3267", "content": "\ud83d\udd34 F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks\n\nF5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks.\n\nBIG-IP APM (short for Access Policy Manager) is the company's centralized access management proxy solution that helps admins secure access to their organizations' networks, applications, cloud, and application programming interfaces (APIs).\n\nTracked as CVE-2026-94127, the flaw affects instances configured as an OAuth Authorization Server when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server.", "creation_timestamp": "2026-09-23T12:31:01.000000Z"}, {"uuid": "0a96f94c-5ebe-46cd-b3cd-30a78c48ed9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtue7pk2o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:42.688230Z"}, {"uuid": "4ee0e558-995d-4ea2-b810-d64c882930cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtui4pk2o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:43.146926Z"}, {"uuid": "6e41a4ea-05a4-4692-bc95-92115f832cf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtui5os2o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:43.600631Z"}, {"uuid": "d00be991-49eb-4da8-bd10-73c1710ca9c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtui7nc2o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:44.049798Z"}, {"uuid": "0cb56036-fd6f-4c26-b3e5-6217bad065d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtuiamk2o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:44.472234Z"}, {"uuid": "4b807c72-67d5-4149-be68-a6abbb8d44ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtuicl22o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:44.912044Z"}, {"uuid": "4f0211d6-4c67-46b5-bbc4-cf6d94522fd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtuidkc2o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:45.343454Z"}, {"uuid": "ea50483e-2a2c-4b37-afd3-5e17c776ee5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwbmtuiejk2o", "content": "Security alert: F5 confirmed active exploitation of a BIG-IP APM zero-day (CVE-2026-94127). 14,700+ instances exposed. CISA gave federal agencies until Friday to patch. Do it now if this is your stack. (via BleepingComputer) (5/8)", "creation_timestamp": "2026-09-24T16:00:45.781684Z"}, {"uuid": "18009d24-ce0d-41df-bd56-510b1f202d38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117326997124611926", "content": "WatchTower posted this yesterday:\nWatchTower: Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/ #infosec #vulnerability", "creation_timestamp": "2026-09-24T16:38:20.875270Z"}, {"uuid": "2d33130f-c057-406d-b79d-5d80a8ce0981", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "96c16751-1b73-43f8-8ab4-831c0a20223d", "vulnerability": "CVE-2026-94127", "type": "confirmed", "source": "https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "content": "", "creation_timestamp": "2026-09-24T16:48:59.969920Z"}, {"uuid": "41a967a0-946c-4526-aeb8-16eb9a3c31f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwbstw2s3y2p", "content": "No public/github CVE-2026-94127 F5 BIG-IP APM exploit yet?\n\n\u2014 from @HackingLZ (https://x.com/HackingLZ/status/2103176887925084234)", "creation_timestamp": "2026-09-24T17:48:06.920005Z"}, {"uuid": "d994ca08-3a16-4cf5-9902-7aa752321dac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwbtroaqwc2d", "content": "F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks\n\nF5 warns of a critical BIG-IP APM zero-day, CVE-2026-94127, allowing remote code execution. Attackers are already exploiting it. F5 has released emergency security updates for a critical vulnerability, tracked as CVE-2026-9\u2026\n#hackernews #news", "creation_timestamp": "2026-09-24T18:04:46.143376Z"}, {"uuid": "2062e67a-02cf-44f1-98d8-3ea0b5ee3fe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117327719192487804", "content": "\u203c\ufe0f[POC] CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)\nGitHub: https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/", "creation_timestamp": "2026-09-24T19:42:02.468652Z"}, {"uuid": "33ba5239-1fce-42e2-9daa-2e1081a13be1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwc4swyu7j2l", "content": "F5, BIG-IP, a 20-year-old primitive, a security appliance,  an \"authentication\" mechanism - and a CISA promise ring.\n\nYes, it's CVE-2026-94127.\n\nGive us strength. Speak soon xo\nhttps://t.co/1l3e0Y3wNN\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2102900734249377909)", "creation_timestamp": "2026-09-24T20:46:32.294503Z"}]}